About this actor
[WIRTE](https://attack.mitre.org/groups/G0090) is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. [WIRTE](https://attack.mitre.org/groups/G0090) has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. [WIRTE](https://attack.mitre.org/groups/G0090) has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)(Citation: Check Point Wirte NOV 2024)(Citation: Palo Alto Ashen Lepus DEC 2025)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 42 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1027Obfuscated Files or Information ↗T1027.010Command Obfuscation ↗T1027.015Compression ↗T1036Masquerading ↗T1036.005Match Legitimate Resource Name or Location ↗T1041Exfiltration Over C2 Channel ↗T1059Command and Scripting Interpreter ↗T1059.001PowerShell ↗T1059.003Windows Command Shell ↗T1059.005Visual Basic ↗T1071Application Layer Protocol ↗T1071.001Web Protocols ↗T1074Data Staged ↗T1074.001Local Data Staging ↗T1105Ingress Tool Transfer ↗T1106Native API ↗T1114Email Collection ↗T1114.001Local Email Collection ↗T1140Deobfuscate/Decode Files or Information ↗T1204User Execution ↗T1204.001Malicious Link ↗T1204.002Malicious File ↗T1218System Binary Proxy Execution ↗T1218.010Regsvr32 ↗T1497Virtualization/Sandbox Evasion ↗T1497.001System Checks ↗T1566Phishing ↗T1566.001Spearphishing Attachment ↗T1566.002Spearphishing Link ↗T1571Non-Standard Port ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗T1583Acquire Infrastructure ↗T1583.001Domains ↗T1586Compromise Accounts ↗T1586.002Email Accounts ↗T1588Obtain Capabilities ↗T1588.002Tool ↗T1608Stage Capabilities ↗T1608.001Upload Malware ↗T1684Social Engineering ↗T1684.001Impersonation ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 26 / 42 | 62% |
CM-6 | 23 / 42 | 55% |
SI-3 | 23 / 42 | 55% |
CM-2 | 22 / 42 | 52% |
CA-7 | 18 / 42 | 43% |
CM-7 | 16 / 42 | 38% |
AC-4 | 15 / 42 | 36% |
SI-7 | 15 / 42 | 36% |
SC-7 | 13 / 42 | 31% |
SI-10 | 13 / 42 | 31% |
AC-3 | 11 / 42 | 26% |
SI-2 | 11 / 42 | 26% |
AC-6 | 10 / 42 | 24% |
AC-2 | 9 / 42 | 21% |
IA-9 | 7 / 42 | 17% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- LazyScripter 0.41
- C0021 0.39
- APT-C-36 0.37
- TA505 0.35
- Operation Spalax 0.35
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00